ccna book by todd lammle

ccna book by todd lammle.Pre-Shared Keys (Pre.sharedKeys,PSK)-Manually enter a value for a pre-shared key for each peer and use this value to authenticate the peer. At each end, the PSKs are combined with other information to form the authentication key. Each peer must authenticate its peer at the opposite end before the tunnel can be considered secure. Pre-shared keys are easy to configure manually but do not scale well because each IPSec peer must configure the pre-shared key for every other peer with which it communicates.RSA signatures - Authenticate peers by exchanging digital certificates. The local device obtains a hash value and encrypts the hash value using the private key. The encrypted hash is appended to the message and sent to the remote end as a signature. The remote end uses the local public key to decrypt the encrypted hash value. If the decrypted hash value matches the recomputed hash value, the signature is true. Before the tunnel is considered secure, each peer must first authenticate its peer at the opposite end.Another less common method of accomplishing authentication is to use RSA-encrypted random numbers (RSA-encryptednonces). Random numbers are generated by peers. RSA-encrypted random numbers use RSA to encrypt random numbers and other values. This method requires that the public keys of both peers be present on the other peer before an IKE exchange can complete the third and fourth messages. From there, the public keys must be manually copied to each peer as part of the configuration process.8.3.1.5 Secure Key ExchangeEncryption algorithms such as DES, 3DES, and AES, as well as MD5 and SHA.1 hashing algorithms, require a symmetric shared key for encryption and decryption. How do encryption and decryption devices get this shared key? Email, courier, etc. can be used to send the shared key to the device administrator. But the simplest method of key exchange is a public key exchange method between encryption and decryption devices.DH (Diffie-Hellman ) key negotiation is a public key exchange method that provides a way for two peers to establish a shared key that only they know, even if the two peers are communicating using an insecure channel. Different forms of DH key exchange algorithms are called DH groups. There are several types of DH groups as follows.8.3 IPSec VPN Components and Operations 229DH groups 1, 2, and 5 support primemodulus fetching, using key lengths of 768 bits, 1024 bits, and 1536 bits, respectively. As of 2012, these groups are no longer recommended.DH groups 14, 15 and 16 use larger key lengths of 2048 bits, 3072 bits and 4096 bits, respectively. These groups are recommended for use until 2030.DH groups 19 and 24 support EllipticalCurveCryptography (ECC), which reduces the time required to generate keys. They use 256-bit, 384-bit and 2048-bit key lengths respectively. DU Group 24 has a longer lifetime.